WordPress Groups Plugin Insecure Direct Object Reference Vulnerability in Group Join Function

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the Groups plugin for WordPress, affecting all versions through 6.7.0. The issue arises in the group_join function, where the 'group_id' parameter lacks proper validation, allowing authenticated attackers with Subscriber-level access and above to join arbitrary groups instead of those specified in the shortcode.

Impact

Exploitation of this vulnerability allows authenticated users to join groups arbitrarily, potentially leading to unauthorized access to group-specific content or features.

Remediation

Users are advised to update the Groups plugin to version 6.8.0 or later.